{"id":"CVE-2026-102918","kind":"vulnerability","aliases":["CVE-2026-102918"],"related":[],"title":"WordPress Redux Framework plugin: stored XSS via user profile field","description":"The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.5.15 via the multi_media field. This is due to the field's renderer printing the stored value into an href attribute, a hidden input value and an HTML element without escaping, while every neighbouring attribute in the same method is wrapped in esc_attr(). It is compounded by Redux_Extension_Users::user_meta_save() evaluating a field's 'permissions' requirement against a user id taken from the request body ('checkuser_id') rather than the current user, so a Subscriber can write a field declared for 'manage_options'. This makes it possible for authenticated attackers with Subscriber-level access and above to inject arbitrary web scripts into their own profile record that execute when an administrator views that user's profile in the dashboard. Requires a theme or plugin that registers a multi_media field through the Redux Users API.","summary":"The Redux Framework plugin for WordPress fails to escape a stored multi_media field value, and a Subscriber can save that field through a user-id mismatch in the permission check. An attacker can plant a script in their own profile that runs in an administrator's browser when the administrator views that profile in the dashboard.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["redux-framework","runtime","self-hosted","wordpress"],"not_affected_if":["no-multi-media-field","redux-users-api-unused"],"how_to_check":"- Check whether the Redux Framework plugin is installed and its version is `4.5.15` or earlier in the WordPress plugins screen.\n- Look for a theme or plugin that registers a `multi_media` field through the Redux Users API.","fix":null,"status":"open","published_at":"2026-10-30T18:17:14+00:00","first_seen_at":"2026-10-30T18:55:28+00:00","triaged_at":"2026-10-30T18:57:08+00:00","updated_at":"2026-10-30T18:57:08+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-30T18:57:08Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress Redux Framework plugin: stored XSS via user profile field","impact":"medium","summary":"The Redux Framework plugin for WordPress fails to escape a stored multi_media field value, and a Subscriber can save that field through a user-id mismatch in the permission check. An attacker can plant a script in their own profile that runs in an administrator's browser when the administrator views that profile in the dashboard.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["wordpress","redux-framework","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"script runs in an administrator's dashboard session","analyst_note":"","how_to_check":"- Check whether the Redux Framework plugin is installed and its version is `4.5.15` or earlier in the WordPress plugins screen.\n- Look for a theme or plugin that registers a `multi_media` field through the Redux Users API.","plain_action":"","needs_analyst":false,"not_affected_if":["no-multi-media-field","redux-users-api-unused"],"who_is_affected":"Sites running Redux Framework up to and including 4.5.15 where a theme or plugin registers a multi_media field through the Redux Users API. Subscriber-level accounts can reach the flaw, and the payload executes when an administrator opens the affected user's profile in the dashboard. Sites without that registered field, or without the Redux Users API in use, are not exposed as described.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000713,"input_tokens":4339,"output_tokens":558,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-102918':13A,16A '-2026':12A,15A '4.5.15':104C 'access':203C 'administr':71B,76B,220C 'api':244C 'arbitrari':208C 'attack':58B,198C 'attr':148C 'attribut':125C,139C 'authent':197C 'bodi':173C 'browser':73B 'check':56B 'checkus':174C 'compound':151C 'cross':94C 'cross-sit':93C 'current':179C 'cve':11A,14A 'dashboard':82B,228C 'declar':188C 'due':112C 'element':133C 'esc':147C 'escap':33B,135C 'evalu':159C 'everi':137C 'execut':217C 'extens':154C 'fail':31B 'field':10A,38B,46B,109C,115C,161C,187C,239C 'framework':3A,19B,27B,85C 'hidden':127C 'host':23B 'href':124C 'html':132C 'id':51B,168C,175C 'includ':103C 'inject':207C 'input':128C 'level':202C 'make':193C 'manag':190C 'media':37B,108C,238C 'meta':157C 'method':143C 'mismatch':52B 'multi':36B,107C,237C 'neighbour':138C 'option':191C 'permiss':55B,163C 'plant':60B 'plugin':4A,28B,86C,233C 'possibl':195C 'print':118C 'profil':9A,66B,79B,214C,225C 'rather':176C 'record':215C 'redux':2A,18B,26B,84C,153C,242C 'redux-framework':17B 'regist':235C 'render':117C 'request':172C 'requir':164C,229C 'run':68B 'runtim':20B 'save':44B,158C 'script':62B,96C,210C 'self':22B 'self-host':21B 'site':95C 'store':5A,35B,92C,120C 'subscrib':42B,183C,201C 'subscriber-level':200C 'taken':169C 'theme':231C 'user':8A,50B,155C,156C,167C,180C,223C,243C 'user-id':49B 'valu':39B,121C,129C 'version':99C 'via':7A,105C 'view':77B,221C 'vulner':90C 'web':209C 'without':134C 'wordpress':1A,24B,30B,88C 'wrap':145C 'write':185C 'xss':6A","nicknames":[],"mitigations":[],"who_affected":"Sites running Redux Framework up to and including 4.5.15 where a theme or plugin registers a multi_media field through the Redux Users API. Subscriber-level accounts can reach the flaw, and the payload executes when an administrator opens the affected user's profile in the dashboard. Sites without that registered field, or without the Redux Users API in use, are not exposed as described.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T18:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-102918","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102918","severity":null,"published_at":"2026-10-30T18:17:14+00:00","modified_at":"2026-10-30T18:33:26+00:00","first_seen_at":"2026-10-30T18:55:28+00:00","fetched_at":"2026-10-30T18:55:28+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}